Top Risks

• proxy permission allows routing all browser traffic through echosecure.space, an unverified third-party domain
• Privacy policy is Google's generic policy, not scoped to this extension — admits data collection and 3rd-party sharing
• install_url_hijack opens echosecure.space on install; free-webmail dev with no developer name or verified identity
• Free-webmail Gmail developer, no verified publisher, no business website — low accountability
• Small install count (59) with HIGH-tier permission (proxy) — tail attack surface

Evidence

• proxy_permission manifest proxy declared — can intercept and reroute all browser traffic to echosecure.space
• install_url_hijack store onInstalled opens https://echosecure.space/ — unknown third-party domain, no reputation data
• generic_privacy_policy store Privacy URL is Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true
• free_webmail_dev_no_name store Developer email namikkm13@gmail.com, developer_name empty, no verified publisher badge
• js_external_host crx echosecure.space is the sole external JS host — single-domain proxy backend, unverified
• small_install_high_perm api 59 installs with proxy (HIGH) permission — install_perm_anomaly confirmed
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction declared
• host_geo_single_RU api JS host in RU only; VPN routing traffic through Russian infrastructure raises jurisdictional risk

Permissions Breakdown

• proxy high Full proxy control: can redirect all browser traffic through attacker-controlled servers.

Pillar Scores

Bookkeeping